Author: reschke
Date: Fri Jan 31 13:56:21 2020
New Revision: 1873417
URL: http://svn.apache.org/viewvc?rev=1873417&view=rev
Log:
OAK-8870 : UserAuthentication.authenticate should remove pw attribute
(CVE-2020-1940) (merged r1873103 into 1.22)
Modified:
jackrabbit/oak/branches/1.22/ (props changed)
jackrabbit/oak/branches/1.22/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserAuthentication.java
jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryAndForceInitialChangeTest.java
jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryHistoryTest.java
jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ResetExpiredPasswordTest.java
Propchange: jackrabbit/oak/branches/1.22/
------------------------------------------------------------------------------
Merged /jackrabbit/oak/trunk:r1873103
Modified:
jackrabbit/oak/branches/1.22/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserAuthentication.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.22/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserAuthentication.java?rev=1873417&r1=1873416&r2=1873417&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.22/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserAuthentication.java
(original)
+++
jackrabbit/oak/branches/1.22/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserAuthentication.java
Fri Jan 31 13:56:21 2020
@@ -132,6 +132,8 @@ class UserAuthentication implements Auth
principal = user.getPrincipal();
} catch (RepositoryException e) {
throw new LoginException(e.getMessage());
+ } finally {
+ removeNewPwAttribute(credentials);
}
return success;
}
@@ -213,6 +215,12 @@ class UserAuthentication implements Auth
return false;
}
+ private static void removeNewPwAttribute(@NotNull Credentials credentials)
{
+ if (credentials instanceof SimpleCredentials) {
+ ((SimpleCredentials)
credentials).removeAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD);
+ }
+ }
+
private boolean impersonate(AuthInfo info, User user) {
try {
if (user.getID().equals(info.getUserID())) {
Modified:
jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryAndForceInitialChangeTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryAndForceInitialChangeTest.java?rev=1873417&r1=1873416&r2=1873417&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryAndForceInitialChangeTest.java
(original)
+++
jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryAndForceInitialChangeTest.java
Fri Jan 31 13:56:21 2020
@@ -35,8 +35,10 @@ import org.jetbrains.annotations.NotNull
import org.junit.Before;
import org.junit.Test;
+import static
org.apache.jackrabbit.oak.spi.security.user.UserConstants.CREDENTIALS_ATTRIBUTE_NEWPASSWORD;
import static
org.apache.jackrabbit.oak.spi.security.user.UserConstants.REP_PWD;
import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
@@ -137,4 +139,16 @@ public class PasswordExpiryAndForceIniti
userManager.setPassword(userTree, "uNew", "pwd", true);
assertFalse(userTree.hasChild(REP_PWD));
}
+
+ @Test
+ public void testAuthenticateWithNewPasswordAttribute() throws Exception {
+ Authentication a = new UserAuthentication(getUserConfiguration(),
root, userId);
+ SimpleCredentials sc = new SimpleCredentials(userId,
userId.toCharArray());
+ sc.setAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD,
"SureChangedMyPassword!");
+ try {
+ assertTrue(a.authenticate(sc));
+ } finally {
+ assertNull(sc.getAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD));
+ }
+ }
}
Modified:
jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryHistoryTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryHistoryTest.java?rev=1873417&r1=1873416&r2=1873417&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryHistoryTest.java
(original)
+++
jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryHistoryTest.java
Fri Jan 31 13:56:21 2020
@@ -36,6 +36,7 @@ import javax.jcr.SimpleCredentials;
import javax.security.auth.login.CredentialExpiredException;
import java.util.List;
+import static
org.apache.jackrabbit.oak.spi.security.user.UserConstants.CREDENTIALS_ATTRIBUTE_NEWPASSWORD;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNull;
import static org.junit.Assert.fail;
@@ -103,6 +104,8 @@ public class PasswordExpiryHistoryTest e
"credentials should contain pw change failure reason",
"New password is identical to the current password.",
attr);
+ } finally {
+
assertNull(pwChangeCreds.getAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD));
}
}
}
@@ -134,6 +137,8 @@ public class PasswordExpiryHistoryTest e
"credentials should contain pw change failure reason",
"New password was found in password history.",
attr);
+ } finally {
+
assertNull(pwChangeCreds.getAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD));
}
}
}
@@ -160,6 +165,8 @@ public class PasswordExpiryHistoryTest e
} catch (CredentialExpiredException c) {
// success, pw found in history
assertNull(pwChangeCreds.getAttribute(PasswordHistoryException.class.getSimpleName()));
+ } finally {
+
assertNull(pwChangeCreds.getAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD));
}
}
}
Modified:
jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ResetExpiredPasswordTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ResetExpiredPasswordTest.java?rev=1873417&r1=1873416&r2=1873417&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ResetExpiredPasswordTest.java
(original)
+++
jackrabbit/oak/branches/1.22/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ResetExpiredPasswordTest.java
Fri Jan 31 13:56:21 2020
@@ -30,10 +30,13 @@ import org.apache.jackrabbit.oak.spi.sec
import org.apache.jackrabbit.oak.spi.security.user.UserConfiguration;
import org.apache.jackrabbit.oak.spi.security.user.UserConstants;
import org.apache.jackrabbit.oak.spi.security.user.util.PasswordUtil;
+import org.jetbrains.annotations.Nullable;
import org.junit.Before;
import org.junit.Test;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
@@ -43,6 +46,7 @@ import static org.junit.Assert.fail;
public class ResetExpiredPasswordTest extends AbstractSecurityTest implements
UserConstants {
private String userId;
+ private SimpleCredentials creds;
@Before
public void before() throws Exception {
@@ -63,13 +67,18 @@ public class ResetExpiredPasswordTest ex
}
private void authenticate(String expiredPw, Object newPw) throws
LoginException {
- SimpleCredentials creds = new SimpleCredentials(userId,
expiredPw.toCharArray());
+ creds = new SimpleCredentials(userId, expiredPw.toCharArray());
creds.setAttribute(UserConstants.CREDENTIALS_ATTRIBUTE_NEWPASSWORD,
newPw);
Authentication a = new UserAuthentication(getUserConfiguration(),
root, userId);
a.authenticate(creds);
}
+ private static void assertCredentials(@Nullable SimpleCredentials sc) {
+ assertNotNull(sc);
+ assertNull(sc.getAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD));
+ }
+
@Test
public void testPasswordChangePersisted() throws Exception {
authenticate(userId, "newPw");
@@ -78,11 +87,13 @@ public class ResetExpiredPasswordTest ex
Root rootBasedOnSeparateSession =
login(getAdminCredentials()).getLatestRoot();
Tree userTree =
rootBasedOnSeparateSession.getTree(getTestUser().getPath());
assertTrue(PasswordUtil.isSame(userTree.getProperty(UserConstants.REP_PASSWORD).getValue(Type.STRING),
"newPw"));
+ assertCredentials(creds);
}
@Test
public void testAuthenticatePasswordExpiredThenChanged() throws Exception {
authenticate(userId, userId);
+ assertCredentials(creds);
}
@Test
@@ -96,6 +107,7 @@ public class ResetExpiredPasswordTest ex
Tree userTree = root.getTree(getTestUser().getPath());
assertTrue(PasswordUtil.isSame(userTree.getProperty(UserConstants.REP_PASSWORD).getValue(Type.STRING),
userId));
assertEquals(0,
userTree.getChild(UserConstants.REP_PWD).getProperty(UserConstants.REP_PASSWORD_LAST_MODIFIED).getValue(Type.LONG).longValue());
+ assertCredentials(creds);
}
}
@@ -110,6 +122,7 @@ public class ResetExpiredPasswordTest ex
Tree userTree = root.getTree(getTestUser().getPath());
assertTrue(PasswordUtil.isSame(userTree.getProperty(UserConstants.REP_PASSWORD).getValue(Type.STRING),
userId));
assertEquals(0,
userTree.getChild(UserConstants.REP_PWD).getProperty(UserConstants.REP_PASSWORD_LAST_MODIFIED).getValue(Type.LONG).longValue());
+ assertCredentials(creds);
}
}
}
